You can enter SQL queries or Crab commands. SQL queries need a semicolon on the end; commands do not.

Use %quit to finish the Crab session.Use %show to see current Crab settingsUse %help to access Crab reference info

You can cancel a running scan or query with Ctrl+C or Ctrl+Break

Multi line queries

If you write each query as one long line, you can recall and edit queries from your history (with Ctrl+P). But it is difficult to see what is going on, especially when there are subqueries.

Another option is to edit multi-line queries in a text editor such as TextEdit or Notepad, then paste them into the Crab command line. You can paste in one go, you don't need to paste line by line. Don't forget the semicolon at the end of the last line.

A third option is to write the query in a text editor, save it as a Crab script file, and run the script from Crab using the %read command. e.g.

CRAB> %read 'C:\somepath\myscript.crab'

Layout of query results

By default, query results at the Crab command line are shown as a set of field:value pairs, called a dictionary. This is convenient for displaying long fields such as paths. Set this output mode with

The interactive command line is useful for exploring data and developing queries, but once you have a query that works the most efficient way to rerun it is to use a text editor to save it as a text file, and execute it with the %read command, or the -init start up option, e.g.

CRAB> %read analyzetree.crab

You can run scripts without an interactive command line by using the -batch option at Crab startup. This tells Crab to scan any paths provided (if any), and to run any commands or queries provided (if any), and then quit.

C:\> crab -batch -init analyzetree.crab

When running queries in batch, output is returned as comma delimited lists unless you use a command line switch at Crab start up. See the "Launching Crab" documentation.

Batch mode instant SQL

You can use Crab to extend Windows Command Line with SQL queries.

E.g. the following command scans the current directory, and lists the fullpath of all the files: